Vulnerability · Published Jun 27, 2022 · Assigned by GitHub_M
CVE-2022-31094Cross site scripting vulnerability in ScratchTools
High 7.1
In plain English
A high-severity cross-site scripting in ScratchTools from STForScratch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Official description
ScratchTools is a web extension designed to make interacting with the Scratch programming language community (Scratching) easier. In affected versions anybody who uses the Recently Viewed Projects feature is vulnerable to having their account taken over if they view a project that tries to. The issue is that if a user visits a project that includes Javascript in the title, then when the Recently Viewed Projects feature displays it, it could run the Javascript. This issue has been addressed in the 2.5.2 release. Users having issues scratching should open an issue in the project issue tracker https://github.com/STForScratch/ScratchTools/
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| STForScratch | ScratchTools | >= 2.4.0, < 2.5.2 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L